Is That Really Their Voice? Preparing for AI Voice and Deepfake Fraud
Key points
- A voice or a face is no longer proof of identity. AI can clone a family member's or a boss's voice, and faces on video calls can be generated too
- The strongest test is the police's own list of things real officers never do: announce an investigation by phone, contact you via messaging apps, send images of police IDs or warrants, or suddenly video-call your personal phone. Any one of these means fraud
- Caller ID can be spoofed — even a real police headquarters number has been displayed. If money comes up, hang up and call back on a number you already have
- Agree on a family code word, and verify transfers through a second channel at work. The defence is a confirmation rule decided in advance, not technology
Official sources
(Lead) A voice on the phone that sounds exactly like family, or a face on a video call that looks exactly like your boss, is no longer proof of who you are talking to. Voice cloning from short samples is now common, and police have released scam footage in which the "officer's" face is suspected to have been generated or altered by AI. This guide is not about the technology — it is the set of confirmation rules that still work.
A voice or a face is no longer evidence
Fraud has moved from phone calls to messaging apps and video calls. According to the National Police Agency, "fake police" scams reached 11,014 reported cases in 2025 (39.6% of all special fraud) with losses of JPY 100.5 billion (70.6%). Scammers have spoofed the caller ID of real police headquarters numbers, so even a genuine-looking number proves nothing.
What real police officers never do
The National Police Agency publishes this test. Real officers never:
- Tell you by phone that you are under investigation
- Contact you through messaging apps
- Send images of a police ID or an arrest warrant
- Suddenly video-call your personal smartphone
If any one of these happens, it is fraud — no matter how real the voice or face seems. Hang up, do not call back the number they gave you, and consult your nearest police station in person or call the police consultation line .
Protecting your family: a code word and a call-back rule
- Agree on one family code word. Any phone call about money starts by asking for it
- The more urgent and secretive the request ("right now", "tell no one"), the more important it is to hang up and call back on the number you already have saved
- For elderly family members, write these two rules on paper and keep them by the phone
Protecting your company: one more confirmation before transfers
- Never execute a transfer on the strength of a voice or video call alone. Confirm through a second channel — a call to a registered number, or in person
- Decide the transfer procedure and approvers in writing, in normal times. Urgency does not skip the procedure
- Share suspicious instructions inside the company before acting on them
Summary: today's checklist
- Shared with family: police never discuss investigations or transfers by phone
- Decided a family code word
- Made it a rule: money talk means hang up and call back on a saved number
- Set the company rule: transfers are confirmed through a second channel
Review your current posture with 25 questions. Runs in your browser only.
Check your understanding
Tap an answer to check yourself. Nothing is saved or sent.
Q1. Which of these do real police officers never do?
See the answer
The National Police Agency states officers never announce an investigation by phone. The same applies to messaging apps, images of IDs or warrants, and sudden video calls.
Q2. The caller ID shows a real police headquarters number. How should you judge it?
See the answer
Police have published cases where real headquarters numbers were spoofed. Hang up and consult a station in person or call #9110.
Q3. What actually protects against a family member's "send money" call?
See the answer
Voices and faces can both be reproduced by AI. Verify with a code word and a call back to a number you already have.
Read next
Stop Reusing Passwords — The First Step
Why reusing the same password is dangerous (credential-stuffing / password-list attacks) and how to stop, step by step, based on official IPA and JPCERT/CC guidance.
Read more →What Is the Cyber Threat Forecast? The Four Levels and How to Read Them
How to read the Cyber Threat Forecast, without technical terms: the four levels (Normal, Attention, Warning, Emergency), why Japan and the world have separate levels, and how to use the page day to day.
Read more →See the latest threat intelligence